Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-11979 DESCRIPTION: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell functi...

Introducing CAIRN: Frontier tracking for AI-integrated malware

A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally and inevitably leave behind markers of their own: prompt templates, provider endpoints, API keys,...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub - node-fetch-3.1.1.tgz, Jinja2-3.0.3-py3-none-any.whl, dompurify-3.4.11.tgz, react-router-6.30.4.tgz, react-router-dom-6.30.4.tgz, brace-expansion-5.0.8.tgz, browserslist-4.26.2.tgz, baseline-browser-mapping-2.10.38.tg...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-27794 DESCRIPTION: LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.2 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-75899...

.NET Framework - Leaking ObjRefs via HTTP .NET Remoting

.NET Framework Information Disclosure Vulnerability id: CVE-2024-29059 info: name: .NET Framework - Leaking ObjRefs via HTTP .NET Remoting author: iamnoooob,rootxharsh,DhiyaneshDk,pdresearch severity: high description: .NET Framework Information Disclosure Vulnerability impact: | Attackers can...

SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:4275-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4275-1 advisory. Security issues fixed: - CVE-2015-8863: heap buffer overflow in tokenadd function bsc976992. - CVE-2023-50246:...

SUSE SLES12: openCryptoki / openCryptoki-32bit / openCryptoki-64bit / etc (SUSE-SU-2026:2685-2)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2685-2 advisory. This update for openCryptoki fixes the following issue: - CVE-2026-40253: malformed BER-encoded cryptographic objects can lead to informatio...

Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8800-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8800-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws i...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each...

OPENSUSE-SU-2026:21900-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

SUSE-SU-2026:23867-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

SUSE-SU-2026:23856-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Executive summary In April 2026, we at Kaspersky's Global Emergency Response Team GERT responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization's Active Directory environment and authored a...

Security update for jq

This update for jq fixes the following issues: Security issues fixed: CVE-2015-8863: heap buffer overflow in tokenadd function bsc976992. CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString bsc1218034. CVE-2023-50268: stack-based buffer overflow in...

SUSE-SU-2026:4275-1 Security update for jq

This update for jq fixes the following issues: Security issues fixed: - CVE-2015-8863: heap buffer overflow in tokenadd function bsc976992. - CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString bsc1218034. - CVE-2023-50268: stack-based buffer overflow ...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.4.2 Vulnerability Details CVEID:CVE-2026-44897 DESCRIPTION: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading builds the opening...

exploit-priority-scanner

exploit-priority-scanner Vulnerability prioritization pipelin...

Security Bulletin: Multiple vulnerabilities addressed in IBM Big Replicate LiveData Migrator 4.0

Summary Multiple vulnerabilities addressed in IBM Big Replicate LiveData Migrator 4.0. The libraries affected include tomcat-embed-core-9.0.110.jar, i18next-http-backend-2.2.0.tgz, spring-web-5.3.39.jar, assertj-core-3.22.0.jar, ability-6.4.0.tgz, netty-codec-http-4.1.128.Final.jar,...